f000b520fb8916bf836e3fe07bc65e64f7c4cf479b5c037821eea5c599c27247

Analysis

max time kernel
30s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

19KB
MD5

f9c511b90ee3d80eccbda61eea8240d7
SHA1

458ade264899f69d91fc133682912ad01b27e9de
SHA256

f000b520fb8916bf836e3fe07bc65e64f7c4cf479b5c037821eea5c599c27247
SHA512

a99cc894a388965b1a9cfcacf30bedd43833be3b5a3a19192a77d1f3141868889d9b98c354a981c6df01ab752b312c7d26680f3eea6bc449e61749f0102c102f
SSDEEP

384:VBJspa1ocy4B4lbGaLBvhpNZivpa81S2m0Y3Y06Ib3Qf51xCejiw:VBj1ocy4aEa1JpNMvl3Y3Y06O3GnxPiw

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1D4F331-4620-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000090523f0f20187d8421fc503041052e603230164ca716b21a208d624264dd2b8a000000000e8000000002000020000000525d59942357520edf78784dd2ba92a32d1fba98fd759a444852294dad0d98312000000093136d6c52a97ae41a32803d02d8a26549cb85cb61ae9958c88057584c1647174000000069c14bfa683881d12de997f718d036d81b941152ef29c70e50d2660c7249ee48b2fe31839a0a3f278c21a5ff6429659c01cf05074ac559c3ac28eebb06cd0605	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02450b62ddada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000fd523d97a7d64394cca17f8ba10976feade5a1aa8015b4e18dc050648662011f000000000e800000000200002000000008b5d53a2837f00e8f8b00fa689a764a87f7c95690398d50f7bb13881a06baf590000000fdc26ce5bcdf2c23e2fadc137c776631d36548b69708526412f9082c183aa875bfae45129bb96d0f76449c2ab2fb0e569f53ee8661734c0e4d6ec899b1d94c9b6014025d92f4975c4066180c7e251ac4d42429742a13b3d418aa9d1a215c8165c09255e07343aff355b49e8503c8819286980accab2a853479dd034b3318a8ecb6daedc1f5344aaa1f4e848a6997b822400000001389c10f251dc00bdd782eeb9457c323cc164f948d4886538181d5c64957a3345bdb309fbbab34ff3bdf5c08e26b446ee52485870410bcaf4b1c8abb3e883ddf	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2656	2672	iexplore.exe	31
PID 2672 wrote to memory of 2656	2672	iexplore.exe	31
PID 2672 wrote to memory of 2656	2672	iexplore.exe	31
PID 2672 wrote to memory of 2656	2672	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de8952a2b3dde8d9f079f99b4aee8415

SHA1
f824fc0224028717659182b5880d3c09208c94c0

SHA256
ba156650b37e2815e8ac5fd5a686d519901acaf5355a005e9888db131507b1c2

SHA512
26e65c9db85490660e3deed425b95070dc4f43ae3d11cc28bebf0fec23174c55ba48e7d651ed3abe16e7f23b87347b4af370ce36fb89f18060bdea77335ad60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e137fcc2066d0ad12591f6a3a31c9fb

SHA1
9d233b79e24b225f92cf36b2b4737ca87d030da6

SHA256
dc8bccaffeba7e32c5e35ce45e9fdf9e607286553078d7b4b61d50f883c0abba

SHA512
cbe35215f32546248c26a44822f33409311231d162addfc6850c3839a3eea534ce0d5bf5f08ebbd8ef586f79c06437b9bde0fcb8e913b2fa4ba4f7699e2cc935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
074b82996d3e0457b56602da784a32b2

SHA1
8468018a4b740b2f02ede40bde850e6848147ad0

SHA256
1bd87d35c32b41c58fea7dfab0d3a1aa6ca1a09efe7fc3b01d5c7932ca9b2ab2

SHA512
af14d51ed3aa1b42119a387424e611f32e5d805c89a450e41bd55245223fd6b695247fef08988a850ed13e3b9d8dd0268506b26fe93845739dc7ac368321e2c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
630be7c65c2196af5f4595b71a5a2b0c

SHA1
7b0ca91d4aa8b04d8dc1aca51ce6dcd0ed1197b2

SHA256
593bfc6ee3dbe028c9cf9cb3c229449a6a2535d102a6927357b653b7836975b9

SHA512
35899ff22a10af4a25ce6aa4dcc0cf2b6fcac8e9c89ea7fe78c02c153217f0562c5912304a6fc51938a9d8ce10cbb8c3088d604cbcc1c0fb39fed1c2f8b27d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f73b58fc8e43b7797f9defc190979086

SHA1
52d1fe8f60fbacb92d79c9f39e9b4c97f8c73d1d

SHA256
ab5b222a7bfde13c293b35e79bd863848740efa77e805e1fc370b6c5b5f65007

SHA512
0256792c7e70f141e66283a49ad0cb96f38b4eef7dad29450d8af44d57250681572953783bc0ede2817d2b08e905caff241f6ead52f2aba49b86c5be0ac88314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
880756319df7651f553d299c30db6c92

SHA1
7337ce0713d38227812bc593a286cd59f1b6cc57

SHA256
756f6a245f7a5e72aee3822eb7571abcbddeb797528447625c9277912893f7fd

SHA512
74323d991f63a0c5d59a2248d7579cc84ee42081d9901a8b5edfb47e8f7fc2a505cf68b4c12291532668be5c03cd2b1bd8b364b84edde51f421fd102b082762b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afae9ef5fef7f736089e9d1e33723c40

SHA1
a1f607337095bb34432649de1a2f9aeed48decbb

SHA256
9968711ac9f027cc2c629353e951f43c6fa5feedd9b12b427aca7272bcc7b9fb

SHA512
c443faf4b5002a2e4898b04d02df9a86b50ee6f8e14a0f70bd8d30503e1e7f091bbed3c9dee18ed2469b1a4cd55d4c49c957f9c9d1f91595df281bd172e35f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec0ce9352b823b6e1708e748f40f7ff2

SHA1
ebbddb98cf0f63f4ac5489758f4a2589564f0743

SHA256
f3404210e1acfbe983847799d51fadb4c3d4a93b0ad40c47ccd990be3ac9c32d

SHA512
108ff88b54248999a24d06af0005a62c3c4786383b0966918fbcd48c68eb56f25746799d264781288994b717fbe53edccb2f9ada128aa307b670875f95e6874f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5cdcefb92dade5aced3922eddd7e0ea

SHA1
6804932b038f8097f386ac85cf4531a273494df4

SHA256
8995f199bd8adbc27d8fc5c4e18b2406e827a72aab94232ec246f05fc7bebd72

SHA512
55e4bab37c164f2fe5f546b33d6afeb088045f8504339e55c8492e9f55a9858afd7437479b92fd65b94521bb317359a196109e7b6f73f08a6efe470cb8e80fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e79ea2e866f5a268d0ace710bd449b25

SHA1
1738dc36805673132ed513b6c24932530f53ac2a

SHA256
c45af5861a2b5150e49bd9bed38d9a7eab92bdc94bfe08e307c0ca2e1a44ab53

SHA512
f42856deb7663f8f45da04bdae553e5238646daf06b5b1e528f3a62a612c0848cfb3ba4dd8d0f26308fcec57b6a3bdaa279c3948dab21d28fa8905d69f75021e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab438.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit